diff --git a/.custodian-brief.md b/.custodian-brief.md
index fe8a1f2..70010a1 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — railiance-cluster
 
 **Domain:** financials  
-**Last synced:** 2026-10-13 18:10 UTC  
+**Last synced:** 2026-10-13 18:24 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Current Goal
@@ -11,11 +11,7 @@ Install k3s and Kubernetes Baseline on the HostEurope Server
 
 ## Active Workstreams
 
-### Fix the ingress timeout interrupting Forgejo OCI uploads
-Progress: 0/1 done  |  workplan_id: `c8d8d021-c971-55c2-b386-577ad69416d4`
-
-**Open tasks:**
-- ► Apply the managed timeout and prove image publication  `1db02233`
+*(none — repo may need first-session setup)*
 
 ## Inbox Hygiene
 
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index b1be856..ffbf8bc 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -19,7 +19,7 @@
 | workplan | RAIL-BS-WP-0015 | finished | — | workplans/RAIL-BS-WP-0015-knative-declared-cpu-requests.md |
 | workplan | RCLUSTER-WP-0007 | backlog | — | workplans/RCLUSTER-WP-0007-threephoenix-ha-cluster.md |
 | workplan | RCLUSTER-WP-0014 | finished | — | workplans/RCLUSTER-WP-0014-capacity-utilization-and-allocation-evidence.md |
-| workplan | RCLUSTER-WP-0016 | active | — | workplans/RCLUSTER-WP-0016-forgejo-upload-timeout.md |
+| workplan | RCLUSTER-WP-0016 | finished | — | workplans/RCLUSTER-WP-0016-forgejo-upload-timeout.md |
 | task | RCLUSTER-WP-ADHOC-2026-07-27-T01 | done | — | workplans/ADHOC-2026-07-27.md |
 | task | RAIL-BS-WP-0008-T01 | done | — | workplans/RAIL-BS-WP-0008-activity-core-wp0016-triage-output-deploy.md |
 | task | RAIL-BS-WP-0008-T02 | done | — | workplans/RAIL-BS-WP-0008-activity-core-wp0016-triage-output-deploy.md |
@@ -59,4 +59,4 @@
 | task | RCLUSTER-WP-0014-T01 | done | — | workplans/RCLUSTER-WP-0014-capacity-utilization-and-allocation-evidence.md |
 | task | RCLUSTER-WP-0014-T02 | done | — | workplans/RCLUSTER-WP-0014-capacity-utilization-and-allocation-evidence.md |
 | task | RCLUSTER-WP-0014-T03 | done | — | workplans/RCLUSTER-WP-0014-capacity-utilization-and-allocation-evidence.md |
-| task | RCLUSTER-WP-0016-T01 | progress | — | workplans/RCLUSTER-WP-0016-forgejo-upload-timeout.md |
+| task | RCLUSTER-WP-0016-T01 | done | — | workplans/RCLUSTER-WP-0016-forgejo-upload-timeout.md |
diff --git a/docs/evidence/2026-10-13-published-image-pull.json b/docs/evidence/2026-10-13-published-image-pull.json
new file mode 100644
index 0000000..69ce806
--- /dev/null
+++ b/docs/evidence/2026-10-13-published-image-pull.json
@@ -0,0 +1,12 @@
+{
+  "observed_at": "2026-10-13T18:17:15.031531+00:00",
+  "node": "railiance01",
+  "pull_command": "sudo k3s crictl pull forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441",
+  "pull_exit_code": 0,
+  "image_id": "sha256:5bda1139fda091648b1e984f6be8119291ad5616263b206d62ac7986ba2762b3",
+  "repo_digests": [
+    "forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441"
+  ],
+  "size_bytes": "990518395",
+  "workload_deployed": false
+}
diff --git a/install/traefik/README.md b/install/traefik/README.md
index eb788c9..92232a6 100644
--- a/install/traefik/README.md
+++ b/install/traefik/README.md
@@ -20,7 +20,12 @@ ssh railiance01 'kubectl apply --server-side -f -' < install/traefik/railiance01
 
 Wait for the Helm controller to finish and the replacement Traefik pod to become
 Ready. Verify the actual argument, HTTPS endpoints and a previously failing
-large OCI publication. Rollback: set the argument to 60s in this source and
+large OCI publication. Confirm its registry digest and independently pull the
+immutable reference with `sudo k3s crictl pull <image-reference>` on railiance01.
+The [verified pull receipt](../../docs/evidence/2026-10-13-published-image-pull.json)
+records the first successful release after this change.
+
+Rollback: set the argument to 60s in this source and
 reapply with the same checks; this restores the former upload limitation.
 
 References: [Traefik read timeout](https://doc.traefik.io/traefik/v3.6/reference/install-configuration/entrypoints/)